CVE-2025-31858: Local Magic Auth Bypass Vulnerability

CVE-2025-31858 Overview

CVE-2025-31858 is a missing authorization vulnerability in the Local Magic WordPress plugin developed by matthewrubin. The flaw affects all versions of Local Magic up to and including 2.9.0. The plugin fails to enforce proper access control checks, allowing unauthenticated attackers to interact with functionality that should require authorization.

The issue is classified under [CWE-862] (Missing Authorization). Attackers can exploit incorrectly configured access control security levels to read, modify, or affect plugin-managed data without valid credentials.

Critical Impact
Unauthenticated network attackers can bypass access controls on WordPress sites running Local Magic ≤ 2.9.0, leading to integrity and availability impact on plugin resources.

Affected Products

Local Magic plugin for WordPress (matthewrubin) — versions through 2.9.0
WordPress sites with the local-magic plugin installed and active
Deployments that expose the plugin's endpoints to untrusted networks

Discovery Timeline

2025-04-03 - CVE-2025-31858 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-31858

Vulnerability Analysis

The Local Magic plugin exposes functionality through WordPress action handlers that do not verify the caller's authorization state. According to the Patchstack advisory, the plugin relies on incorrectly configured access control security levels, meaning capability checks and nonce validation are either missing or improperly applied.

An attacker sending crafted HTTP requests to the vulnerable endpoints can trigger plugin actions without authenticating. The attack requires no user interaction and can be performed remotely against any reachable WordPress site running the affected plugin.

The impact is limited to low integrity and low availability effects, with no confidentiality impact reported. This is consistent with a scenario where an attacker can invoke privileged plugin actions but cannot directly read arbitrary sensitive data.

Root Cause

The root cause is the absence of current_user_can() capability checks and missing nonce verification on one or more plugin action handlers. WordPress plugins must explicitly verify user capabilities before executing privileged operations. Local Magic does not enforce these checks consistently through version 2.9.0.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker sends HTTP requests directly to the vulnerable WordPress AJAX or REST endpoints exposed by the plugin. Because the plugin does not validate authorization, requests from anonymous sources are processed as if they were authorized.

See the Patchstack Local Magic Plugin Vulnerability advisory for technical details on the affected endpoints.

Detection Methods for CVE-2025-31858

Indicators of Compromise

Unexpected POST or GET requests to wp-admin/admin-ajax.php or plugin REST routes referencing local-magic actions from unauthenticated sessions
Modifications to plugin-managed options or content without a corresponding authenticated administrator session in access logs
Requests to Local Magic endpoints originating from IP addresses not associated with legitimate administrators

Detection Strategies

Inventory WordPress installations and identify sites running the local-magic plugin at versions ≤ 2.9.0
Review web server access logs for requests targeting plugin action names without accompanying authenticated session cookies
Correlate WordPress audit logs with HTTP request logs to flag privileged actions lacking a valid administrator context

Monitoring Recommendations

Enable verbose logging on WordPress AJAX and REST API endpoints exposed by the plugin
Alert on repeated anonymous requests to plugin-specific action parameters
Monitor for unexpected changes to WordPress wp_options, post metadata, or files managed by Local Magic

How to Mitigate CVE-2025-31858

Immediate Actions Required

Update the Local Magic plugin to a version later than 2.9.0 once the vendor publishes a fix, or deactivate and remove the plugin until a patch is available
Restrict access to wp-admin/admin-ajax.php and plugin REST routes using a web application firewall (WAF) rule that requires authentication for Local Magic actions
Audit WordPress content and configuration for unauthorized modifications made while the vulnerable version was installed

Patch Information

At the time of publication, the NVD entry lists the affected range as n/a through <= 2.9.0. Administrators should consult the Patchstack advisory for the latest fixed version information and apply the vendor-supplied update as soon as it becomes available.

Workarounds

Deactivate the Local Magic plugin until a patched version is released
Block external access to plugin endpoints at the WAF or reverse proxy layer
Enforce IP allowlisting on wp-admin for known administrator networks to reduce exposure

bash

# Example WAF rule (ModSecurity) to block unauthenticated access to Local Magic AJAX actions
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
    "chain,phase:2,deny,status:403,id:1003158,\
    msg:'Block unauthenticated Local Magic action'"
    SecRule ARGS:action "@rx ^local_magic_" \
        "chain"
        SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"